CVE-2026-9150

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

A stack-based buffer overflow vulnerability was found in the libsolv library within the PGP verification component. The flaw is caused by incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker can craft a malicious Ed25519 PGP signature with mismatched MPI lengths, leading to denial of service in automated package or repository processing workflows.

libsolv has a heap buffer overflow vulnerability during decompression of attacker-controlled compressed data in .solv files due to insufficient input validation. A crafted .solv file can lead to out-of-bounds memory access, potentially causing information disclosure, program execution alteration, or denial of service.

A heap buffer overflow vulnerability has been found in the libsolv library when processing a specially crafted .solv file with negative size values in the repo_add_solv function. This leads to undersized memory allocation and out-of-bounds write, which can be exploited for a DoS attack.